prep vault geo HA
This commit is contained in:
parent
6165689b69
commit
6e729ee58b
3 changed files with 24 additions and 6 deletions
|
@ -67,7 +67,7 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
vault-secrets = lib.mkIf (config.networking.domain == "olympus") {
|
vault-secrets = lib.mkIf (config.networking.domain == "olympus") {
|
||||||
vaultPrefix = "secrets/nixos";
|
vaultPrefix = "olympus_secrets/nixos";
|
||||||
vaultAddress = "http://vault.olympus:8200/";
|
vaultAddress = "http://vault.olympus:8200/";
|
||||||
approlePrefix = "olympus-${config.networking.hostName}";
|
approlePrefix = "olympus-${config.networking.hostName}";
|
||||||
};
|
};
|
||||||
|
|
|
@ -2,8 +2,10 @@
|
||||||
# your system. Help is available in the configuration.nix(5) man page
|
# your system. Help is available in the configuration.nix(5) man page
|
||||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||||
|
|
||||||
{ config, pkgs, ... }:
|
{ config, pkgs, hosts, ... }:
|
||||||
let port = 8200;
|
let
|
||||||
|
port = 8200;
|
||||||
|
clusterPort = 8201;
|
||||||
in {
|
in {
|
||||||
# This value determines the NixOS release from which the default
|
# This value determines the NixOS release from which the default
|
||||||
# settings for stateful data, like file locations and database versions
|
# settings for stateful data, like file locations and database versions
|
||||||
|
@ -17,17 +19,23 @@ in {
|
||||||
environment.systemPackages = with pkgs; [ ];
|
environment.systemPackages = with pkgs; [ ];
|
||||||
|
|
||||||
# Vault
|
# Vault
|
||||||
networking.firewall.allowedTCPPorts = [ port ];
|
networking.firewall.allowedTCPPorts = [ port clusterPort ];
|
||||||
|
|
||||||
services.vault = {
|
services.vault = {
|
||||||
enable = true;
|
enable = true;
|
||||||
# bin version includes the UI
|
# bin version includes the UI
|
||||||
package = pkgs.vault-bin;
|
package = pkgs.vault-bin;
|
||||||
address = "0.0.0.0:${toString port}";
|
address = "0.0.0.0:${toString port}";
|
||||||
storageBackend = "file";
|
storageBackend = "raft";
|
||||||
storagePath = "/var/lib/vault";
|
storagePath = "/var/lib/vault-raft";
|
||||||
|
storageConfig = ''
|
||||||
|
node_id = "olympus-1"
|
||||||
|
'';
|
||||||
extraConfig = ''
|
extraConfig = ''
|
||||||
ui = true
|
ui = true
|
||||||
|
disable_mlock = true
|
||||||
|
api_addr = "http://10.42.42.6:${toString port}"
|
||||||
|
cluster_addr = "http://10.42.42.6:${toString clusterPort}"
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
10
nixos/hosts/olympus/vault/migrate.hcl
Normal file
10
nixos/hosts/olympus/vault/migrate.hcl
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
storage_source "file" {
|
||||||
|
path = "/var/lib/vault"
|
||||||
|
}
|
||||||
|
|
||||||
|
storage_destination "raft" {
|
||||||
|
path = "/var/lib/vault-raft"
|
||||||
|
node_id = "olympus-1"
|
||||||
|
}
|
||||||
|
|
||||||
|
cluster_addr = "http://vault.olympus:8201"
|
Loading…
Reference in a new issue